Ignore:
File:
1 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/iptables.xml

    rda54a62 r92d18a9  
    77  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
    88  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
    9   <!ENTITY iptables-md5sum        "602ba7e937c72fbb7b1c2b71c3b0004b">
    10   <!ENTITY iptables-size          "704 KB">
    11   <!ENTITY iptables-buildsize     "22 MB">
    12   <!ENTITY iptables-time          "0.1 SBU">
     9  <!ENTITY iptables-md5sum        "bc0f0adccc93c09dc5b7507ccba93148">
     10  <!ENTITY iptables-size          "700 KB">
     11  <!ENTITY iptables-buildsize     "17 MB">
     12  <!ENTITY iptables-time          "0.2 SBU">
    1313]>
    1414
    … …  
    1717
    1818  <sect1info>
     19    <othername>$LastChangedBy$</othername>
    1920    <date>$Date$</date>
    2021  </sect1info>
    … …  
    3132    <para>
    3233      <application>iptables</application> is a userspace command line program
    33       used to configure the Linux 2.4 and later kernel packet filtering ruleset.
    34     </para>
    35 
    36     &lfs110a_checked;
     34      used to configure Linux 2.4 and later kernel packet filtering ruleset.
     35    </para>
     36
     37    &lfs10_checked;
    3738
    3839    <bridgehead renderas="sect3">Package Information</bridgehead>
    … …  
    7778      <xref linkend="libpcap"/> (required for nfsypproxy support),
    7879      <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink>
    79       (required for Berkeley Packet Filter support),
     80      (required for Berkely Packet Filter support),
    8081      <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink>
    8182      (required for connlabel support),
    82       <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink>
    83       (required for connlabel support), and
     83      <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack"</ulink>, and
     84      (required for connlabel support)
    8485      <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
    8586    </para>
    … …  
    148149
    149150<screen><userinput>./configure --prefix=/usr      \
     151            --sbindir=/sbin    \
    150152            --disable-nftables \
    151             --enable-libipq    &amp;&amp;
     153            --enable-libipq    \
     154            --with-xtlibdir=/lib/xtables &amp;&amp;
    152155make</userinput></screen>
    153156
    … …  
    165168    </para>
    166169
    167 <screen role="root"><userinput>make install</userinput></screen>
     170<screen role="root"><userinput>make install &amp;&amp;
     171ln -sfv ../../sbin/xtables-legacy-multi /usr/bin/iptables-xml &amp;&amp;
     172
     173for file in ip4tc ip6tc ipq xtables
     174do
     175  mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
     176  ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
     177done</userinput></screen>
    168178
    169179  </sect2>
    … …  
    174184    <para>
    175185      <parameter>--disable-nftables</parameter>: This switch disables building
    176       nftables compatibility. <!--Omit this switch if you have installed
     186      nftables compat. <!--Omit this switch if you have installed
    177187      <xref linkend="nftables"/>.-->
    178188    </para>
    … …  
    185195
    186196    <para>
     197      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
     198      <application>iptables</application> modules are installed in the
     199      <filename class="directory">/lib/xtables</filename> directory.
     200    </para>
     201
     202    <para>
    187203      <option>--enable-nfsynproxy</option>: This switch enables installation
    188204      of <application>nfsynproxy</application> SYNPROXY configuration tool.
     205    </para>
     206
     207    <para>
     208      <command>ln -sfv ../../sbin/xtables-legacy-multi /usr/bin/iptables-xml</command>:
     209      Ensure the symbolic link for <command>iptables-xml</command> is relative.
    189210    </para>
    190211
    … …  
    220241      <para>
    221242        A Personal Firewall is designed to let you access all the
    222         services offered on the Internet while keeping your computer secure and
     243        services offered on the Internet, but keep your box secure and
    223244        your data private.
    224245      </para>
    … …  
    229250        url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
    230251        Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
    231         to the Linux 5.x kernels.
     252        to the Linux 3.x kernels.
    232253      </para>
    233254
    … …  
    301322iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    302323
    303 # Log everything else.
     324# Log everything else. What's Windows' latest exploitable vulnerability?
    304325iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    305326
    … …  
    379400iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    380401
    381 # Log everything else.
     402# Log everything else. What's Windows' latest exploitable vulnerability?
    382403iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    383404
    … …  
    413434
    414435      <para>
    415         A Network Firewall has two interfaces, one connected to an
     436        A network Firewall has two interfaces, one connected to an
    416437        intranet, in this example <emphasis role="strong">LAN1</emphasis>,
    417438        and one connected to the Internet, here <emphasis
    418439        role="strong">WAN1</emphasis>. To provide the maximum security
    419440        for the firewall itself, make sure that there are no unnecessary
    420         servers running on it such as <application>X11</application>.
     441        servers running on it such as <application>X11</application> et al.
    421442        As a general principle, the firewall itself should not access
    422443        any untrusted service (think of a remote server giving answers that
    … …  
    439460echo "You can find additional information"
    440461echo "about firewalls in Chapter 4 of the BLFS book."
    441 echo "https://www.&lfs-domainname;/blfs"
     462echo "http://www.&lfs-domainname;/blfs"
    442463echo
    443464
    … …  
    735756        </listitem>
    736757        <listitem>
    737           <para id='fw-BB-4-ipt' xreflabel="BusyBox with iptables example number 4">
     758          <para id='fw-BB-4-ipt' xreflabel="BusyBox with iptable example number 4">
    738759            If you are frequently accessing FTP servers or enjoy chatting, you
    739760            might notice delays because some implementations of these daemons
    … …  
    853874      <seglistitem>
    854875        <seg>
    855           ip6tables,
    856           ip6tables-apply,
    857           ip6tables-legacy,
    858           ip6tables-legacy-restore,
    859           ip6tables-legacy-save,
    860           ip6tables-restore,
    861           ip6tables-save,
    862           iptables,
    863           iptables-apply,
    864           iptables-legacy,
    865           iptables-legacy-restore,
    866           iptables-legacy-apply,
    867           iptables-restore,
    868           iptables-save,
    869           iptables-xml,
    870           nfsynproxy (optional),
    871           and xtables-multi
     876          ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
     877          iptables-save, iptables-xml, nfsynproxy (optional) and xtables-multi
    872878        </seg>
    873879        <seg>
    874           libip4tc.so,
    875           libip6tc.so,
    876           libipq.so,
    877           libiptc.so,
    878           and libxtables.so
     880          libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
    879881        </seg>
    880882        <seg>
    881           /lib/xtables and
    882           /usr/include/libiptc
     883          /lib/xtables and /usr/include/libiptc
    883884        </seg>
    884885      </seglistitem>
    … …  
    895896          <para>
    896897            is used to set up, maintain, and inspect the tables of
    897             IP packet filter rules in the Linux kernel
     898            IP packet filter rules in the Linux kernel.
    898899          </para>
    899900          <indexterm zone="iptables iptables-prog">
    … …  
    903904      </varlistentry>
    904905
    905       <varlistentry id="iptables-apply">
    906         <term><command>iptables-apply</command></term>
    907         <listitem>
    908           <para>
    909             is a safer way to update iptables remotely
    910           </para>
    911           <indexterm zone="iptables iptables-apply">
    912             <primary sortas="b-iptables-apply">iptables-apply</primary>
    913           </indexterm>
    914         </listitem>
    915       </varlistentry>
    916 
    917       <varlistentry id="iptables-legacy">
    918         <term><command>iptables-legacy</command></term>
    919         <listitem>
    920           <para>
    921             is used to interact with iptables using the legacy command set
    922           </para>
    923           <indexterm zone="iptables iptables-legacy">
    924             <primary sortas="b-iptables-legacy">iptables-legacy</primary>
    925           </indexterm>
    926         </listitem>
    927       </varlistentry>
    928 
    929       <varlistentry id="iptables-legacy-restore">
    930         <term><command>iptables-legacy-restore</command></term>
    931         <listitem>
    932           <para>
    933             is used to restore a set of legacy iptables rules
    934           </para>
    935           <indexterm zone="iptables iptables-legacy-restore">
    936             <primary sortas="b-iptables-legacy-restore">iptables-legacy-restore</primary>
    937           </indexterm>
    938         </listitem>
    939       </varlistentry>
    940 
    941       <varlistentry id="iptables-legacy-save">
    942         <term><command>iptables-legacy-save</command></term>
    943         <listitem>
    944           <para>
    945             is used to save a set of legacy iptables rules
    946           </para>
    947           <indexterm zone="iptables iptables-legacy-save">
    948             <primary sortas="b-iptables-legacy-save">iptables-legacy-save</primary>
    949           </indexterm>
    950         </listitem>
    951       </varlistentry>
    952 
    953906      <varlistentry id="iptables-restore">
    954907        <term><command>iptables-restore</command></term>
    … …  
    957910            is used to restore IP Tables from data specified on
    958911            STDIN. Use I/O redirection provided by your
    959             shell to read from a file
     912            shell to read from a file.
    960913          </para>
    961914          <indexterm zone="iptables iptables-restore">
    … …  
    971924            is used to dump the contents of an IP Table in easily
    972925            parseable format to STDOUT. Use I/O-redirection
    973             provided by your shell to write to a file
     926            provided by your shell to write to a file.
    974927          </para>
    975928          <indexterm zone="iptables iptables-save">
    … …  
    986939            <command>iptables-save</command> to an XML format. Using the
    987940            <filename>iptables.xslt</filename> stylesheet converts the XML
    988             back to the format of <command>iptables-restore</command>
     941            back to the format of <command>iptables-restore</command>.
    989942          </para>
    990943          <indexterm zone="iptables iptables-xml">
    … …  
    999952          <para>
    1000953            are a set of commands for IPV6 that parallel the iptables
    1001             commands above
     954            commands above.
    1002955          </para>
    1003956          <indexterm zone="iptables ip6tables">
    … …  
    1013966            (optional) configuration tool. SYNPROXY target makes handling of
    1014967            large SYN floods possible without the large performance penalties
    1015             imposed by the connection tracking in such cases
     968            imposed by the connection tracking in such cases.
    1016969          </para>
    1017970          <indexterm zone="iptables nfsynproxy">
    … …  
    1025978        <listitem>
    1026979          <para>
    1027             is a binary that behaves according to the name it is called by
     980            is a binary that behaves according to the name it is called by.
    1028981          </para>
    1029982          <indexterm zone="iptables xtables-multi">
Note: See TracChangeset for help on using the changeset viewer.